The German Whistleblower Protection Act requires many companies and public authorities to set up a reporting office through which breaches and misconduct can be reported. At the same time, whistleblowers must be protected against reprisals. Reporting channels are intended to make it easier to report misconduct such as fraud or corruption and to provide better protection for whistleblowers. This page explains which organisations are affected by the German Whistleblower Protection Act (HinSchG), which requirements and duties apply and how an online form can be used as a reporting channel.
Table of Contents
What is the German Whistleblower Protection Act?
The German Whistleblower Protection Act (HinSchG) implements the EU Whistleblower Directive and governs the handling of reports of breaches within companies and public authorities. It is intended to provide better protection for people who report breaches. The Act sets out specific requirements for internal and external reporting offices, reporting channels, procedures and protective measures. These include, in particular, confidentiality and protection against reprisals.
Which organisations are affected by the Whistleblower Protection Act?
The number of employees is particularly important when determining whether an internal reporting office is required. Under Section 12 HinSchG, employers with generally at least 50 employees must establish and operate at least one internal reporting office. For certain organisations, particularly in regulated financial sectors, this obligation applies regardless of the number of employees. For municipalities, associations of municipalities and employers controlled by them, the obligation is governed by the relevant law of the German federal state concerned.
Internal reporting offices must in particular be established:
- by employers with generally at least 50 employees,
- by the organisations listed in Section 12(3) HinSchG, regardless of the number of employees,
- by public-sector employers in accordance with the legal requirements that apply to them.
When must reporting offices be established?
The statutory transitional periods for establishing internal reporting offices have now expired. Private-sector employers with generally 50 to 249 employees had to establish their internal reporting offices by 17 December 2023 at the latest. Employers that are now subject to the obligation under Section 12 HinSchG must have an internal reporting office in place and operating.
Anyone who, contrary to Section 12(1), first sentence, HinSchG, fails to ensure that an internal reporting office is established and operated commits an administrative offence. Under Section 40 HinSchG, this can result in a fine of up to €20,000. Depending on the offence, other breaches, such as certain forms of obstruction of reports, reprisals or intentional or reckless breaches of confidentiality, can result in fines of up to €50,000.
Internal reporting office: requirements and responsibilities
Internal reporting channels must allow reports to be made orally or in text form. Oral reports must be possible by telephone or another form of voice communication. At the whistleblower's request, a face-to-face meeting must also be arranged within a reasonable period.
The reporting channels must be designed so that only those responsible for receiving and processing reports, and those assisting them, have access to incoming reports. Confidentiality must be maintained: the identity of the whistleblower and of other people named in the report must be protected in accordance with the statutory requirements.
In addition to operating the reporting channels, the responsibilities of the internal reporting office include receiving and assessing reports, communicating with the whistleblower, following the statutory procedure and taking appropriate follow-up measures. A follow-up measure may, for example, be an internal investigation or referral of the case to a competent authority.
What happens after a report is received?
Once a report has been submitted, a defined procedure begins. As a rule, the internal reporting office must acknowledge receipt to the whistleblower within seven days. It then checks whether the reported breach falls within the scope of the HinSchG and whether the report is substantiated. If information is missing, it can ask follow-up questions and remains in contact with the whistleblower while the report is being processed.
As a rule, the reporting office must provide feedback no later than three months after acknowledging receipt. The feedback covers planned or already implemented follow-up measures and the reasons for them. However, feedback may only be provided insofar as it does not affect internal enquiries or investigations or prejudice the rights of people who are the subject of, or named in, the report.
Employees of the company or public authority, an internal organisational unit or an external third party may be entrusted with the responsibilities of an internal reporting office. The people appointed must be independent in carrying out these duties and have the necessary expertise.
The responsibilities of an internal reporting office may be assigned to suitably qualified employees of the company or public authority or to an external third party.
Internal or external reporting office?
Whistleblowers can generally choose whether to contact an internal or an external reporting office. The HinSchG states that internal reporting should be preferred where the breach can be dealt with effectively within the organisation and there is no risk of reprisals. Companies should therefore do more than simply provide a reporting channel: employees should also be able to find out easily how to use it and what happens to their report afterwards. This must not restrict the option of reporting externally.
Online form as a reporting channel: benefits, tips and template
Online forms can be suitable reporting channels for whistleblowing, provided that access and processing are set up to comply with the statutory requirements. In particular, only authorised people must be able to access incoming reports. With online forms created using LamaPoll, access can be controlled through user and permission management. You can find detailed instructions in our help desk: User management in your account.
If you want to use LamaPoll both as a whistleblowing system and for surveys, there are a few points to bear in mind. Find out more here: Using LamaPoll as a whistleblowing system and for surveys
What should you consider when setting up a digital reporting channel?
A form on its own does not make a functioning whistleblowing system. Before going live, you should decide who may receive and process incoming reports, how follow-up questions will be handled, how follow-up measures will be documented and when that documentation will be deleted. Under Section 11 HinSchG, documentation of a report must generally be deleted three years after the procedure has been completed. It may be retained for longer where this is necessary and proportionate.
The decision whether to allow anonymous reports should also be made deliberately. Anonymity and confidentiality are not the same thing: with confidential reporting, the reporting office may know the whistleblower's identity but must protect it in accordance with the statutory requirements. With an anonymous report, the whistleblower does not provide their identity in the first place. The HinSchG does not require internal reporting channels to allow anonymous reports, but anonymously received reports should be processed.
Online forms created with LamaPoll can be embedded in your organisation's website and adapted visually to its corporate design. The forms are responsive and can therefore also be used on mobile devices.
Whistleblowing forms generally use questions about the circumstances of the case and free-text fields for describing the breach. Different paths through the form can also be created so that users only see questions or input fields relevant to them. For example, the same form can be used to receive reports and, via a different path, enquiries from people seeking advice. Technically, a form can also support both anonymous and non-anonymous reports. For more information on creating online forms as a whistleblowing system, see: Digital whistleblowing system using an online form
Our free template can help you create an online form for whistleblowers. Click “Use template” to copy the whistleblowing form to your own LamaPoll account, where you can adapt it to your requirements.
With LamaPoll, surveys can be created quickly and easily. The tool offers many options for individual adjustments. The help pages are useful for solving many questions independently. For special requests, competent and easily accessible customer support is available.
What is LamaPoll?
LamaPoll is a Germany-based tool for creating online surveys and online forms. For a reporting channel, you can adapt a form to your use case, set access permissions for processing incoming reports and, if required, embed the form in your website. In addition to whistleblowing forms, LamaPoll can be used for other internal and external surveys and forms. You can try LamaPoll free of charge.
